It’s time for mandatory data breach reporting to the Office of Civil Rights (“OCR”) under The Health Information Technology for Economic and Clinical Health Act (“HITECH”) and the interim/final breach notification rules.  Yes, it’s February – time for Valentines, cold and snow (in the Northeast anyway), but most importantly, HITECH requires regulated entities (“covered entities”) to report smaller-scale data breaches (those affecting fewer than 500 individuals) to OCR.  These breach reports are due within 60 days following the end of the calendar year in which the breach occurred.   So, covered entities that experienced a breach or breaches involving fewer than 500 individuals in 2011 should make any required reports to OCR by the end of February.  If you are a covered entity with HITECH reporting obligations, the following resources may be helpful: 

*Instructions for notifying OCR of breaches affecting fewer than 500 individuals; and

*Form for submitting notice to OCR.

Even if you did not experience a reportable breach, it is helpful to review the notification form and to become familiar with the type of information that must be gathered and reported in the event of a data breach.